Hello, help me please solve mail issue. See all information below:
The operating system my web server runs on is (include version): Raspberry Pi OS Debian GNU/Linux 12 (Linux 6.6.74+rpt-rpi-v8)
My hosting provider, if applicable, is: Local ISP Lanet. I contacted them and got answer that they doesn't block 25 port.
I can login to a root shell on my machine (yes or no, or I don't know): Yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No, I use SSH myself.
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 2.1.0
I have mail server Postfix 3.7.11 + Dovecot 2.3.19.1. I opened all necessary ports on my router. I set up Thunderbird client and I can send message to Gmail. I added A, MX, DMARK, DKIM, SPF DNS records on Cloudfare.
Unfortunately, I can't receive mail from Gmail.
My Postfix logs:
Feb 12 16:04:10 mail postfix/smtpd[207040]: connect from mail-ed1-f41.google.com[209.85.208.41]
Feb 12 16:04:10 mail postfix/smtpd[207040]: setting up TLS connection from mail-ed1-f41.google.com[209.85.208.41]
Feb 12 16:04:10 mail postfix/smtpd[207040]: mail-ed1-f41.google.com[209.85.208.41]: TLS cipher list "aNULL:-aNULL:HIGH:MEDIUM:+RC4:@STRENGTH"
Feb 12 16:04:10 mail postfix/smtpd[207040]: SSL_accept:before SSL initialization
Feb 12 16:05:18 mail postfix/smtpd[208116]: SSL_accept:error in before SSL initialization
As I understood, my settings are correct, but maybe it cause of misunderstanding what is certificate use? In this case, I use mail.ostrich.kyiv.ua certificate.
After 12 hours I got message back:
The recipient server did not accept our requests to connect. For more information, go to support page [mydomainname, myip: unable to read banner]
My config file has banner settings:
smtpd_banner = $myhostname ESMTP $mail_name
myhostname = mail.ostrich.kyiv.ua
So I ask this community because I have two domains:
- ostrich.kyiv.ua - for my web server and it is ma
- mail.ostrich.kyiv.ua - I set up this domain for mail server and issued for it additional certificate to cover subdomain *.ostrich.kyiv.ua
in this case, like example:
- /etc/letsencrypt/live/ostrich.kyiv.ua-0001/fullchain.pem - for mail.ostrich.kyiv.ua
- /etc/letsencrypt/live/ostrich.kyiv.ua/fullchain.pem for ostrich.kyiv.ua (not use for mail)
Any suggestions how to fix it?
/etc/postfix/main.cf
myorigin = /etc/mailname
myhostname = mail.ostrich.kyiv.ua
mydomain = ostrich.kyiv.ua
smtpd_banner = $myhostname ESMTP $mail_name
biff = no
append_dot_mydomain = no
readme_directory = no
compatibility_level = 3.6
smtpd_tls_cert_file = /etc/letsencrypt/live/ostrich.kyiv.ua-0001/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/ostrich.kyiv.ua-0001/privkey.pem
smtpd_tls_security_level = may
smtpd_tls_auth_only = yes
smtpd_tls_received_header = yes
smtpd_tls_wrappermode = yes
smtpd_tls_loglevel = 2
smtpd_tls_protocols = !SSLv2,!SSLv3
smtpd_tls_mandatory_protocols = >=TLSv1.2
smtpd_tls_eecdh_grade = strong
smtpd_use_tls = yes
smtp_tls_CApath = /etc/ssl/certs
smtp_tls_security_level = may
smtp_tls_loglevel = 1
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtp_tls_protocols = !SSLv2,!SSLv3
smtp_tls_mandatory_protocols = >=TLSv1.2
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_relay_restrictions =
permit_mynetworks
permit_sasl_authenticated
defer_unauth_destination
smtpd_recipient_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destination
mydestination = ostrich.kyiv.ua, mail.ostrich.kyiv.ua, localhost.localdomain, localhost
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
home_mailbox = Maildir/
maillog_file = /var/log/mail.log
milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891
/etc/postfix/master.cf
smtp inet n - y - - smtpd
smtps inet n - y - - smtpd
-o syslog_name=postfix/smtps
-o smtpd_tls_wrappermode=yes
-o smtpd_sasl_auth_enable=yes
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
submission inet n - y - - smtpd
-o syslog_name=postfix/submission
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
pickup unix n - y 60 1 pickup
cleanup unix n - y - 0 cleanup
qmgr unix n - n 300 1 qmgr
tlsmgr unix - - y 1000? 1 tlsmgr
rewrite unix - - y - - trivial-rewrite
bounce unix - - y - 0 bounce
defer unix - - y - 0 defer
trace unix - - y - 0 trace
verify unix - - y - 1 verify
flush unix n - y 1000? 0 flush
proxymap unix - - n - - proxymap
proxywrite unix - - n - 1 proxymap
smtp unix - - y - - smtp
relay unix - - y - - smtp
showq unix n - y - - showq
error unix - - y - - error
retry unix - - y - - error
discard unix - - y - - discard
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - y - - lmtp
anvil unix - - y - 1 anvil
dovecot unix - n n - - pipe
flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -d ${recipient}
/etc/dovecot/dovecot.conf
!include_try /usr/share/dovecot/protocols.d/.protocol
!include conf.d/.conf
!include_try local.conf
log_path = /var/log/dovecot.log
auth_verbose = yes
protocols = imap lmtp
/etc/dovecot/conf.d/10-ssl.conf
ssl = required
ssl_cert = </etc/letsencrypt/live/ostrich.kyiv.ua-0001/fullchain.pem
ssl_key = </etc/letsencrypt/live/ostrich.kyiv.ua-0001/privkey.pem
ssl_ca = </etc/letsencrypt/live/ostrich.kyiv.ua-0001/chain.pem
ssl_client_ca_dir = /etc/ssl/certs
ssl_dh = </usr/share/dovecot/dh.pem
/etc/dovecot/conf.d/10-auth.conf
disable_plaintext_auth = yes
auth_username_format = %n
auth_mechanisms = plain login
!include auth-system.conf.ext
/etc/dovecot/conf.d/10-master.conf
service imap-login {
inet_listener imaps {
port = 993
ssl = yes
}
}
service pop3-login {
inet_listener pop3s {
port = 995
ssl = yes
}
}
service submission-login {
inet_listener submission {
}
}
service lmtp {
unix_listener /var/spool/postfix/private/dovecot-lmtp {
mode = 0600
user = postfix
group = postfix
}
}
service auth {
unix_listener /var/spool/postfix/private/auth {
mode = 0666
user = postfix
group = postfix
}
}
